As Register<\/i> readers know, inputting one’s details into a Google Docs form can be risky<\/a>; El Reg<\/i>‘s own sources, however, suggested something officially sanctioned was definitely afoot.<\/p>\n Similarly, this afternoon Ukraine’s CERT warned in a Facebook post<\/a> that a threat group known as UNC1151 was targeting “private \u2018i.ua\u2019 and \u2018meta.ua\u2019 [email] accounts of Ukrainian military personnel and related individuals” to launch phishing attacks.<\/p>\n Threat intel firm Mandiant said two domains mentioned by the UCERT, i[.]ua-passport[.]space<\/em> and id[.]bigmir[.]space<\/em> were known command-and-control domains of UNC1151, adding: “We are able to tie the infrastructure reported by CERT.UA to UNC1151, but have not seen the phishing messages directly. However, UNC1151 has targeted Ukraine and especially its military extensively over the past two years, so this activity matches their historical pattern.”<\/p>\n UNC1151 was previously attributed<\/a> by Ukrainian officials to Belarus, following deployment of a device-wiping malware strain. Belarus is widely believed in the West to be acting as a proxy for Russia. Another file-destroying software nasty was spotted<\/a> in Ukraine this week by ESET.<\/p>\n